Web and Mobile Application Testing

Applications are used by organisations to provide a range of functionality to customers and staff but are frequently abused by attackers.

What Is It?

Application penetration tests rigorously evaluate the security of an organisation’s web and mobile applications by identifying and exploiting vulnerabilities to assess their potential impact. These tests simulate cyber attacks to uncover weaknesses before they can be exploited by malicious parties.

What Challenges Can Be Addressed By Application Penetration Testing?

Injection Flaws

These occur when an attacker sends malicious data to an application, tricking it into executing unintended commands or accessing data without proper authorisation. SQL injection, command injection, and LDAP injection are common examples.

Broken Authentication

This involves weaknesses in session management and authentication mechanisms, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities.

Sensitive Data Exposure

Inadequate protection of sensitive data, such as financial information, healthcare records, and personal data, can lead to exposure through attacks like eavesdropping, data breaches, or insufficient encryption.

XML External Entities (XXE)

Poorly configured XML processors evaluate external entity references within XML documents. Attackers can exploit XXE vulnerabilities to access internal files, conduct denial-of-service attacks, or perform server-side request forgery (SSRF).

Broken Access Controls

This occurs when users can access data or perform actions outside of their permissions. It can lead to unauthorised access to sensitive information, data modification, or execution of privileged functions.

Security Misconfigurations

This broad category includes all types of misconfigurations in the application, servers, databases, etc., that leave it vulnerable to attacks. Common issues include unnecessary services running, outdated software components, default credentials, and improperly managed cloud storage permissions.

The Forfend Methodology:

Application enumeration – Each engagement commences with an in-depth review of the application’s architecture, functionalities, and security parameters. Forfend’s consultants draw upon their vast reservoir of knowledge to map out the application, focusing keenly on components that pose the highest security threats. This foundational step ensures that the testing strategy is precisely aligned with the application’s unique context.

Beyond Automated Scans – Forfend’s approach integrates a judicious mix of automated tools and manual examination to uncover vulnerabilities. While automated scans are invaluable for flagging common security issues, they are not infallible; they might overlook complex vulnerabilities or flag non-issues. Forfend’s seasoned consultants complement these tools with manual testing techniques, scrutinising the application for nuances and subtleties that automated systems can’t detect, ensuring a comprehensive vulnerability assessment.

Exploit interoperability – Vulnerabilities seldom exist in isolation, and the presence of different vulnerabilities together can often be exploited in conjunction, and can facilitate a cascade of security breaches. This method not only demonstrates the potential for escalated access or data theft but also underscores the criticality of addressing each identified vulnerability.

Why Choose Us?

Experience, Qualifications and Expertise

All Forfend consultants are highly experienced and qualified penetration testers who hold the highest industry certifications. Experts in a comprehensive portfolio of testing methodologies, we identify system vulnerabilities and offer practical remediation advice, in a manner that is understandable and digestible by everyone from management to developers.

Personalised Consultancy Services

We deliver highly personalised, professional consultancy services; the consultant carrying out the engagement being involved throughout the entire process, from initial scoping to testing, reporting, and responding to questions that may arise once the remediation process is underway.

Value For
Money

As a small cyber security consultancy with limited overheads, we’re able to offer prices that are very competitive when compared to the rest of the industry, yet still deliver a high quality engagement. Forfend consultants are well versed at identifying vulnerabilities missed by other consultants.

Experience In A Range Of Industries

Our consultants have experience working in a range of different industries, from central government departments, critical national infrastructure, and councils, to legal, finance and technology sectors. Forfend consultants understand the threats and challenges faced by each industry, and are suited to offer testing types tailored to each sector’s needs.

Applications are used by organisations to provide a range of functionality to customers and staff but are frequently abused by attackers.

What Is It?